Which statement describes symmetric and asymmetric encryption and their relevance to pentesting?

• A. Symmetric uses two keys; asymmetric uses one key; both relevant for securing communications.
• B. Symmetric uses one key; asymmetric uses a key pair; both relevant for securing communications.
• C. Symmetric uses a key pair; asymmetric uses a single key; neither is relevant to pentesting.
• D. Both encryption types require no keys; irrelevant to pentesting.

Answer: (B)

Symmetric encryption uses a single key to both encrypt and decrypt data, so anyone who gains that key can read the information. Asymmetric encryption uses a key pair—a public key for encryption and a private key for decryption—allowing secure key exchange and digital signatures without sharing a secret key in advance. In pentesting, this distinction helps you understand how a service protects data and how keys are managed and exchanged. Many real-world systems combine both: asymmetric cryptography to securely establish a session and authenticate endpoints, followed by symmetric cryptography to efficiently encrypt the bulk of the data during the session. That combination is why both types are relevant for securing communications and for identifying weaknesses in how encryption and keys are implemented or configured.